CVE-2022-2652
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
04 Aug 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Affected products
umlaeute · umlaeute/v4l2loopbackWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →